Online Cycle Detection and Difference Propagation for Pointer Analysis David J. Pearce, Paul H.J. Kelly and Chris Hankin Imperial College, London

What is Pointer Analysis?  Determine targets of pointer variables without running program Analysis would conclude: p  {a}  In general this problem is undecidable >Any solution may be conservative >Must contain actual targets and may contain extra targets - e.g. p  {a,b}  Applications >Compiler – do statements interfere? If not, e.g. can reorder them. >Verification – e.g. can we show there are no NULL pointer errors? int a,b,*p; p = &a;

Constraint Graphs  One node per variable, edges represent assignments  But, what about “ *q = s ” ? >e.g. if q  {a,b} add edges s  b, s  a >Add new edges as solution for q becomes known p = &a; r = &b q = &c; q = p; q = r; pqr {a}{b} {c}

Constraint Graphs  One node per variable, edges represent assignments  But, what about “ *q = s ” ? >e.g. if q  {a,b} add edges s  a, s  b >Add new edges as solution for q becomes known p = &a; r = &b q = &c; q = p; q = r; pqr {a}{b} {a,b,c}

Speeding up Pointer Analysis  Online cycle detection >Variables in cycle must have same solution >Replacing cycles with single node reduces work >Hence, we have designed algorithm for online cycle detection  Difference Propagation >Original idea due to Fecht and Seidl [FS98] >Attempt to reduce cost of propagation -Set union operation typically linear in size of smallest set -Can reduce set size by preventing unnecessary repropagation pq {a}{b}

Empirical Data make LOC uucp LOC gawk LOC bash LOC Execution time (s), to solve constraint graph Notes OCD = Online Cycle Detection 900 MHz Athlon, with 1GB RAM Doesn’t include time to generate or parse constraints and to build initial constraint graph OCD OCD + Diff Prop Diff Prop Base bash 2.05gawk 3.1.0uucp make

Useful Insight  Working with large benchmarks (> 100 KLOC) >Memory requirements prohibitive >Many duplicate solution sets >Hash table scheme from [HT01] addresses this: -Sets stored in hash table with size as hash key -Can actually decrease execution time -Reduces memory requirements by factors of 10 or more  The Heintze-Tardieu Solver >Generally, faster than worklist algorithm – but why? - Doesn’t explore entire graph until complex statements resolved - Because always recomputes solution from scratch? >Doesn’t extend well to some more interesting ideas -For example, worklist algorithm better for modeling integer variables